Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T0884_connection-proxy
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
Passed 22 of 24 test cases with the skill, and 13 of 24 without it.
and 13 more in the full report
10 fixed12 passed either way1 still failing1 broke
Tokens, turns and time describe resource use, not a dollar price.
One of 10 test cases the skill fixed. Same model, same prompt, with and without the skill.
We are organizing our MITRE ATT&CK risk matrix for OT environments. For technique T0884 (Connection Proxy), which exact tactic phase and target platform list apply?
| Checked | Without skill | With skill |
|---|---|---|
| Identifies Command and Control (TA0101) as the kill chain phase. | Passed | Passed |
| Restricts the applicable platform to ICS. | Missed | Passed |
The instructions your model reads when the skill loads.
Adversaries may use a connection proxy to direct network traffic between systems or act as an intermediary for network communications.
The definition of a proxy can also be expanded to encompass trust relationships between networks in peer-to-peer, mesh, or trusted connections between networks consisting of hosts or systems that regularly communicate with each other.
The network may be within a single organization or across multiple organizations with trust relationships. Adversaries could use these types of relationships to manage command and control communications, to reduce the number of simultaneous outbound network connections, to provide resiliency in the face of connection loss, or to ride over existing trusted communications paths between victims to avoid suspicion.
Platforms: ICS
Determine if the target ICS/SCADA environment is susceptible to Connection Proxy by examining operational technology systems and network architecture.
Review whether mitigations for T0884 are in place. If defenses are absent or misconfigured, this technique may be exploitable in the ICS environment.
If it is possible to inspect HTTPS traffic, the captures can be analyzed for connections that appear to be domain fronting.
test cases passed, vs 13 / 24 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.